Corgea
AI-native AppSec platform (BLAST SAST) that finds business-logic vulnerabilities across code, dependencies, containers and IaC, and ships AI-generated pull-request fixes.
Deployment
Cloud
Languages
12+
Pricing model
Per developer seat, Quote-based
Free plan
Yes
Partial means the documentation covers only part of a capability, a related capability, or a beta. The description next to it says what is covered.
Workflow coverage
Where in the development lifecycle Corgea operates.
7 yes 1 partial
| Feature | Availability | Description |
|---|---|---|
| Real-Time IDE Feedback | Partial | On-demand only (Full Scan / Scan Uncommitted Changes), no as-you-type |
| AI Agent Guardrails | Yes | Agent Skill + MCP for Cursor/Claude Code/Copilot/Codex |
| Local Analysis (Pre-Commit) | Yes | corgea setup-hooks; offline deps commands need no network |
| Inline PR Comments | Yes | Inline PR/MR comments (GitHub/GitLab/Azure/Bitbucket/Harness); PR Scanning named at Growth |
| Quality Gates (Merge Blocking) | Yes | Blocks GitHub/Azure/Harness merges, or CI via --block-on; Blocking Rules at Scale |
| Full Repo Scan | Yes | Baseline scan mode from Free tier |
| Scheduled Rescans | Yes | Scheduled re-scan cadences available; enabled at plan level rather than self-serve |
| Runtime Monitoring | Yes | AI Pentesting against live targets; needs admin enablement |
Security scanning
11 yes 2 no
| Feature | Availability | Description |
|---|---|---|
| SAST | Yes | BLAST AI-native SAST, ~900 CWEs, 11 languages |
| Taint Analysis (Data-Flow) | Yes | Cross-file source-to-sink taint tab in BLAST Full View |
| Secrets Detection | Yes | Pattern matching, entropy analysis and AI context |
| Secrets Validation | No | Not documented. Secret-scanning page covers detection methods in depth, never live/provider verification. |
| SCA | Yes | Lockfile/manifest scanning across 25+ ecosystems with CVE/CVSS |
| Reachability Analysis | Yes | Checks import plus whether the vulnerable function is called; direct deps only |
| Malicious Package Detection | Yes | Typosquats, hijacked releases, backdoors via OpenSSF malicious-packages data |
| License Compliance | Yes | SCA captures per-dependency license; enforced via blocking rule; License Enforcement named at Growth |
| SBOM Generation | Yes | corgea deps sbom produces a CycloneDX SBOM |
| IaC Scanning | Yes | Terraform, CloudFormation, Kubernetes, Docker, Helm, Azure ARM |
| Container Scanning | Yes | Base-image/OS/library CVEs across 7 named registries |
| CSPM | No | Not documented. No CSPM/cloud-account-posture page exists anywhere in Corgea's own doc directory. |
| DAST | Yes | AI Pentesting actively tests live web-app targets; API-type breakdown not enumerated |
Code quality
4 yes 1 partial 4 no
| Feature | Availability | Description |
|---|---|---|
| Code Smell Detection | Yes | 9-category AI code review: cleanliness, naming, logic/correctness, incomplete work |
| Complexity Metrics | Partial | Flags deeply-nested logic/complex one-liners qualitatively; no tracked complexity number |
| Duplication Detection | Yes | Detects repeated logic and magic numbers |
| Dead Code Detection | Yes | Empty blocks, unused code, unreachable statements (CWE-563, CWE-1041) |
| Test Coverage Tracking | No | Not documented. The 9-category quality-scanner page never mentions coverage ingestion. |
| Diff Coverage (New Code) | No | Not documented, same page/domain as test coverage. |
| Architecture Governance | Yes | Circular dependencies (CWE-1047) and SOLID violations |
| Technical Debt Quantification | No | Not documented. Framed as preventing technical debt qualitatively; no time/cost quantification. |
| Behavioral Code Analysis | No | Not documented. No git-history hotspot/bus-factor analysis described. |
AI review & fixes
4 yes 1 no
| Feature | Availability | Description |
|---|---|---|
| AI Logic Bug Detection | Yes | Free tier explicitly includes Logic and Auth Scanning |
| PR Summaries & Walkthroughs | No | Not documented. GitHub PR integration page covers finding comments in depth, never a change walkthrough. |
| Autofix Suggestions | Yes | AI generates and quality-checks a fix; auto-fix quota included from Free upward |
| Autofix Pull Requests | Yes | Automatically opens a PR with issue and fix context on GitHub/Azure DevOps/Harness |
| AI Triage (False-Positive Filtering) | Yes | AI classifies findings as false positive with reasoning; AST fingerprinting dedupes across scans |
Rules & repo support
2 yes
| Feature | Availability | Description |
|---|---|---|
| Custom Rule Authoring | Yes | PolicyIQ UI or corgea.yaml policies; YAML needs Scale/Enterprise; Custom Rules named at Scale |
| Monorepo Support | Yes | BLAST endpoint-reachability analysis attributes findings to the correct sub-project within a monorepo. |
AI capabilities
4 yes 3 no
| Feature | Availability | Description |
|---|---|---|
| AI Code Review | Yes | BLAST combines LLM reasoning with static/AST analysis |
| Bring Your Own Model | No | Not documented. Security/agent/MCP pages are covered in depth, never a customer-supplied model or key. |
| MCP Server | Yes | Corgea exposes its own MCP server: 9 read-only tools for scans, issues, dependencies, blocking rules |
| AI Code Governance | No | Not documented. Corgea Agent's scope is fully enumerated (web chat plus 6 PR actions) with no org-wide AI-usage inventory feature. |
| Conversational Review | Yes | Corgea Agent web chat lets teams query scans, issues and policies conversationally |
| Learning From Feedback | No | Not documented. False-positive/fingerprinting pages describe classification and dedup in depth, never adaptive learning. |
| Code Excluded From Training | Yes | Your data is never used to train AI models; Zero Data Retention with OpenAI/Azure OpenAI |
Models used
OpenAIAzure OpenAI
Compliance & governance
4 yes
| Feature | Availability | Description |
|---|---|---|
| Audit Logs | Yes | Audit Logs is an Enterprise-only pricing inclusion |
| SSO (SAML) | Yes | SAML SSO (Okta, Entra ID, generic) with SCIM provisioning; SSO and SCIM is Enterprise-only on pricing |
| Role-Based Access Control | Yes | 6 recommended roles plus custom permission groups across 18 permission categories; Team Management named at Scale |
| Compliance Reporting & Exports | Yes | SARIF/CSV exports plus Reporting and Analytics dashboards at Scale; no framework-mapped report, PDF export in development |
Certifications
SOC 2 Type II
Standards mapping
OWASP Top 10CWE (~900 mappings, incl. Top 25)GDPRHIPAACCPAPCI DSS
Integrations
8 yes 2 no
| Git provider | Availability |
|---|---|
| GitHub | Yes |
| GitHub Enterprise Server | No |
| GitLab | Yes |
| GitLab Self-Managed | Yes |
| Bitbucket | Yes |
| Bitbucket Data Center | No |
| Azure DevOps | Yes |
| API & CLI | Availability |
|---|---|
| REST API | Yes |
| CLI | Yes |
| Webhooks | Yes |
CI/CD systems
GitHub Actions (via CLI in a workflow)
IDEs
VS CodeJetBrains IDEsVisual Studio 2022
Issue trackers
JiraLinear
Chat & notifications
Slack (via Workflow Builder webhook)
Languages
Languages and frameworks named in Corgea's documentation.
C#PythonRubyGoJavaScriptTypeScriptJavaPHPKotlinSwiftRustC/C++
Pricing & plans
$31/dev/month billed annually ($39/dev/month if billed monthly)
Minimum seats: None published on the pricing page as of 2026-08-25 (rendered page checked on both monthly and annual toggles shows no minimum-seat text)
Free$0Individual developers
- AI SAST
- Logic and Auth Scanning
- Dependency Scanning
- Secrets Detection
- Container Scanning
- IaC Scanning
- No PR scanning, code quality, Corgea Agent, Jira integration, or license enforcement
Growth$31/dev/month billed annually ($39/dev/month billed monthly)Teams shipping secure code
- Everything in Free
- PR Scanning
- Code Quality
- Corgea Agent
- JIRA Integration
- License Enforcement
- No custom/blocking rules, reporting & analytics, team management, or API/webhooks
Scale$39/dev/month billed annually ($49/dev/month billed monthly)A true security program (marked Most Popular)
- Everything in Growth
- Custom Rules
- Blocking Rules
- Reporting & Analytics
- Team Management
- APIs / Webhooks
- No SSO/SCIM, single-tenant, SLA management, audit logs, or premium support
EnterpriseCustom (contact sales)Enterprise controls
- Everything in Scale
- SSO & SCIM
- Single-tenant
- SLA Management
- Audit Logs
- Premium Support
- Quote-only, no published numbers
Who it's for
Best for teams whose main security concern is business-logic and auth flaws, starting on a free plan.
A good fit if
- You want business-logic and auth vulnerability detection included from the free plan
- You need PII and PHI scanning alongside secrets detection
- Your developers use AI coding agents and you want a security checkpoint for them through MCP
Consider alternatives if
- You need code quality features such as coverage or technical debt tracking
- You need cloud posture (CSPM) scanning
- You need real-time findings in the IDE as you type
Similar tools
Other Code Security Platform tools in the directory.
AikidoApplication security platform spanning code, cloud, container and runtime scanning with AI triage, autofix and automated pentesting.Checkmarx OneApplication Security Posture Management platform bundling SAST, SCA, IaC, container, API, secret, and DAST scanners under one risk model.GitHub Advanced SecurityGitHub-native AppSec sold as two add-on SKUs — Secret Protection and Code Security — with CodeQL SAST, Dependabot SCA, secret scanning.SemgrepOpen-source pattern-matching SAST engine plus a commercial AppSec Platform adding SCA, secrets detection, policy governance and AI triage.SnykDeveloper security platform covering SAST, SCA, container, IaC, secrets and DAST scanning with risk scoring and automated fix PRs.VeracodeEnterprise AppSec platform spanning SAST, SCA, DAST, container/IaC scanning, AI auto-remediation, ASPM risk management, and developer training.
FAQ
When should you choose Corgea?
Corgea is best for teams whose main security concern is business-logic and auth flaws, starting on a free plan. It's a good fit if:
- You want business-logic and auth vulnerability detection included from the free plan
- You need PII and PHI scanning alongside secrets detection
- Your developers use AI coding agents and you want a security checkpoint for them through MCP
Consider alternatives if:
- You need code quality features such as coverage or technical debt tracking
- You need cloud posture (CSPM) scanning
- You need real-time findings in the IDE as you type
What languages does Corgea support?
Corgea supports 12+ languages and frameworks, including C#, Python, Ruby, Go, JavaScript, TypeScript, Java, PHP, Kotlin, Swift, and 2 more.
What does Corgea integrate with?
Corgea integrates with:
- Source control: GitHub, GitLab, GitLab Self-Managed, Bitbucket and Azure DevOps
- CI systems: GitHub Actions
- IDEs: VS Code, JetBrains IDEs and Visual Studio 2022
What tools are similar to Corgea?
Other code security platforms tracked here:
What are Corgea's plans and pricing?
Corgea has a free plan, and paid plans start at $31/dev/mo. Enterprise pricing is by quote.
Opens corgea.com in a new tab. Review Radar is not affiliated with Corgea.